It now appears that just days
later a group called LulzSecurity -- known for formerly hacking FOX.com's
login database -- has used an injection attack to compromise
databases on Sony BMG Japan.

Astonishingly, Sony appears to have done little to
nothing in the way of escaping or parameterization to protect its databases,
even in the wake of the SQL injection breach of its Greek property.

The hackers accessed an on-site tablet that did
not appear to contain any personally identifiable information. They
openly mocked Sony, posting to
Twitter, "LOL @Sony, Nice Japanese website dumbasses (sic)."

They later posted, "This isn't a l337 h4x0r,
we just want to embarrass Sony some more. Can this be hack number 8? 7
and a half?!"

While the hack itself was obviously just designed
to target Sony and not hurt its customers, the hackers did post publicly that
there was two other databases on the site that they did not look at, but should
be accessible using the injection attack.

This message was likely up for hours -- at least
-- before Sony heard about it and shut down access to its servers. In the
meantime it's very feasible that other users -- including outright malicious
ones -- could have stolen information from these tables. As tables on the
Sony BMG Greece website contained users' names, passwords, etc. it's quite
possible that one of these tables held similar information, and you can almost
guarantee that there would be many more records than in the Greece table, as
Japan is Sony's home nation.

Sophos Security researcher Chester Wisniewski , who yesterday took a gentler tone when covering the Greece intrusion, this time firmly admonished Sony, writing:

While there is an enormous target on Sony's back as a result of these very public attacks it is unclear why this is happening. Is Sony taking security seriously or are there simply so many flaws from the past that exist in their public facing sites that it will take them a long time to patch them all?

I hope this is the last time I have to report on a flaw at Sony. Sony has announced they are working with several professional organizations to get their security house in order and for their sake I hope this happens sooner rather than later.

The problem with all these breaches is that Sony as a company has essentially left customers with no hope that it is properly protecting their data against malicious parties.

It would not be surprising if these customers refuse to use Sony's online properties, taking business to competitors like Microsoft Corp. (MSFT) or Nintendo Comp., Ltd. (7974). Reportedly some customers are already doing exactly that.

III. High Costs for Sony

The average cost of a system intrusion in 2010 was
$318 USD per record lost, up 48 percent from a year prior. Sony claims
that the loss of 101 million records will only cost it $2 USD per record.
Unless the company has found the mother of all "bulk
discounts", when it comes to data loss payouts, the company appears to be
seriously understating the cost to its bottom line.

At the end of the day Sony, much like
Gawker Media, brought on the attacks by lashing out the greater hacker
community, particularly the massive hacker collective Anonymous, which has at
least 10,000 members internationally.

The humiliation of Sony's security is proof that
the online world is still very much like the Wild West. If you anger one
person enough, you may need protection; but if you anger
the masses, half-baked protection outfits may not be good enough.

Sony has clearly been exposed as the inferior to
the hackers in cyber-security. With customers growing wary of the
company, it may pay dearly for its failings to protect its online properties.